Zero-day vulnerability in Adobe Reader

Also cited:

http://www.zdnet.com/dont-open-that-pdf-theres-an-adobe-reader-zero-day-on-the-loose-7000011241/

http://arstechnica.com/security/2013/02/zero-day-attack-exploits-latest-version-of-adobe-reader/

http://nakedsecurity.sophos.com/2013/02/13/adobe-pdf-reader-zero-day/

http://www.f-secure.com/weblog/archives/00002500.html

http://www.webpronews.com/adobe-pdf-reader-hit-by-zero-day-exploit-2013-02

http://www.net-security.org/secworld.php?id=14410

http://www.datamation.com/news/researchers-warn-of-zero-day-adobe-reader-vulnerability.html

http://www.geek.com/articles/news/n...already-being-exploited-by-phishers-20130213/

http://www.securityweek.com/fireeye-researchers-discover-pdf-zero-day-used-active-attacks

 

Does this work on Foxit or the built-in reader in Chrome and Firefox?

 

Thanks Ron!

 

Adobe confirms targeted attacks due to security hole in Reader

Cybercriminals have already taken advantage of the latest security hole in Adobe Reader and Acrobat.

 

I suggest using protected view and EMET. Based on a very quick look (busy) I'd say EMET would stop this.

 

Adobe didn't tell us to disable AdobeARM from MSCONFIG.

Please ask a Mod or an Expert if you are unsure | uncomfortable performing the above action.

 

Thx Ron, then I know when to make an update as I update manually

 

As recommended here.

 

http://blogs.adobe.com/psirt/2013/0...y-for-adobe-reader-and-acrobat-apsa13-02.html

 

EMET 3.5 will prevent this exploit at multiple steps. I would suggest using it.

 

yep
https://twitter.com/msftsecresponse

even 3.0 will do.

 

Re: Adobe Reader XI (11.0.02)

As per:
• http://blogs.adobe.com/psirt/2013/0...y-for-adobe-reader-and-acrobat-apsa13-02.html

Although they did say this week, they did not specify when, alas ...

[avoid bloat - added toolbars, third-party offerings] http://get.adobe.com/reader/

*Note* re-introduces "AdobeARM.exe" to MSCONFIG.

http://www.systemlookup.com/Startup/20618-AdobeARM_exe.html

If you want Adobe Reader phoning home every time you boot your PC, leave at start-up.

 

ExploitShield will stop this also. Video at
http://www.zerovulnerabilitylabs.com/home/exploitshield-corporate-edition-preview/

 

cool

 

EMET is a neat little tool to have or exploit shield.IMO I think everyone should at least one of them on board,Especially having reader,Flash,Java etc.